From 5a1e1e1014759be43f8d1d9b2016c806f62dfc84 Mon Sep 17 00:00:00 2001 From: eaglegai Date: Fri, 5 Nov 2021 10:08:40 +0800 Subject: [PATCH] fix fuzz error --- ...ease-a-fuzzer-which-reports-overflow.patch | 75 +++++++++++++++++++ ...erflow-in-ap_timeout_parameter_parse.patch | 71 ++++++++++++++++++ httpd.spec | 11 ++- 3 files changed, 156 insertions(+), 1 deletion(-) create mode 100644 backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch create mode 100644 backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch diff --git a/backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch b/backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch new file mode 100644 index 0000000..fbed841 --- /dev/null +++ b/backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch @@ -0,0 +1,75 @@ +From 9226cbc6b92492615856b567ac7f7557f196634b Mon Sep 17 00:00:00 2001 +From: Christophe Jaillet +Date: Tue, 10 Aug 2021 18:49:20 +0000 +Subject: [PATCH] Follow up to 1892038, 1892063. + +Improve fix to please a fuzzer which reports: + util.c:2713:26: runtime error: signed integer overflow: + 9999999999999999 * 1000 cannot be represented in type 'long' + +Compute the maximum limit for each case 's', 'h', 'ms' and 'mi' and make sure that the input is below this value. + +While at it, move a comment to make things more consistent and use 'apr_time_from_msec() instead of hand writing it. + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892185 13f79535-47bb-0310-9956-ffa450edef68 +--- + server/util.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/server/util.c b/server/util.c +index 4a35eac6b0c..d87417f7621 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -2668,6 +2668,7 @@ AP_DECLARE(char *) ap_append_pid(apr_pool_t *p, const char *string, + * in timeout_parameter. + * @return Status value indicating whether the parsing was successful or not. + */ ++#define CHECK_OVERFLOW(a, b) if (a > b) return APR_ERANGE + AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + const char *timeout_parameter, + apr_interval_time_t *timeout, +@@ -2697,10 +2698,12 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + switch (*time_str) { + /* Time is in seconds */ + case 's': ++ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX)); + check = apr_time_from_sec(tout); + break; ++ /* Time is in hours */ + case 'h': +- /* Time is in hours */ ++ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX / 3600)); + check = apr_time_from_sec(tout * 3600); + break; + case 'm': +@@ -2710,10 +2713,12 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + switch (*(++time_str)) { + /* Time is in milliseconds */ + case 's': +- check = tout * 1000; ++ CHECK_OVERFLOW(tout, apr_time_as_msec(APR_INT64_MAX)); ++ check = apr_time_from_msec(tout); + break; + /* Time is in minutes */ + case 'i': ++ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX / 60)); + check = apr_time_from_sec(tout * 60); + break; + default: +@@ -2724,12 +2729,11 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + default: + return APR_EGENERAL; + } +- if (check > APR_INT64_MAX || check < 0) { +- return APR_ERANGE; +- } +- *timeout = (apr_interval_time_t) check; ++ ++ *timeout = (apr_interval_time_t)check; + return APR_SUCCESS; + } ++#undef CHECK_OVERFLOW + + /** + * Determine if a request has a request body or not. + * diff --git a/backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch b/backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch new file mode 100644 index 0000000..b9ee124 --- /dev/null +++ b/backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch @@ -0,0 +1,71 @@ +From 7ea44d0402334e40f31730d889c5ad60e158692d Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Fri, 6 Aug 2021 13:10:45 +0000 +Subject: [PATCH] fix int overflow in ap_timeout_parameter_parse + +signed integer overflow in ap_timeout_parameter_parse under fuzzing + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892038 13f79535-47bb-0310-9956-ffa450edef68 +--- + server/util.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/server/util.c b/server/util.c +index 2d7708ae851..6f9dbd4d657 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -2676,6 +2676,7 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + char *endp; + const char *time_str; + apr_int64_t tout; ++ apr_uint64_t check; + + tout = apr_strtoi64(timeout_parameter, &endp, 10); + if (errno) { +@@ -2688,14 +2689,18 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + time_str = endp; + } + ++ if (tout < 0) { ++ return APR_ERANGE; ++ } ++ + switch (*time_str) { + /* Time is in seconds */ + case 's': +- *timeout = (apr_interval_time_t) apr_time_from_sec(tout); ++ check = apr_time_from_sec(tout); + break; + case 'h': + /* Time is in hours */ +- *timeout = (apr_interval_time_t) apr_time_from_sec(tout * 3600); ++ check = apr_time_from_sec(tout * 3600); + break; + case 'm': + switch (*(++time_str)) { +@@ -2705,11 +2710,11 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + switch (*(++time_str)) { + /* Time is in milliseconds */ + case 's': +- *timeout = (apr_interval_time_t) tout * 1000; ++ check = tout * 1000; + break; + /* Time is in minutes */ + case 'i': +- *timeout = (apr_interval_time_t) apr_time_from_sec(tout * 60); ++ check = apr_time_from_sec(tout * 60); + break; + default: + return APR_EGENERAL; +@@ -2719,6 +2724,10 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( + default: + return APR_EGENERAL; + } ++ if (check > APR_INT64_MAX || check < 0) { ++ return APR_ERANGE; ++ } ++ *timeout = (apr_interval_time_t) check; + return APR_SUCCESS; + } + diff --git a/httpd.spec b/httpd.spec index 27239ef..37c5075 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.43 -Release: 10 +Release: 11 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -82,6 +82,8 @@ Patch28: backport-003-CVE-2021-40438.patch Patch29: backport-004-CVE-2021-40438.patch Patch30: backport-001-CVE-2021-39275.patch Patch31: backport-002-CVE-2021-39275.patch +Patch32: backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch +Patch33: backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -518,6 +520,13 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Nov 05 2021 gaihuiying - 2.4.43-11 +- Type:bugfix +- ID:NA +- SUG:restart +- DESC:fix int overflow in ap_timeout_parameter_parse + Improve fix to please a fuzzer int overflow + * Wed Sep 29 2021 gaihuiying - 2.4.43-10 - Type:cves - ID:CVE-2021-40438 CVE-2021-39275 -- Gitee